ArchLinux: 202105-10: squid: denial of service
Summary
- CVE-2021-28651 (denial of service)
Due to a buffer management bug Squid before version 4.15 is vulnerable
to a denial of service attack against the server it is operating on.
This attack is limited to proxies which attempt to resolve a "urn:"
resource identifier. Support for this resolving is enabled by default
in all Squid.
- CVE-2021-28652 (denial of service)
Due to an incorrect parser validation bug Squid before version 4.15 is
vulnerable to a denial of Service attack against the Cache Manager API.
- CVE-2021-28662 (denial of service)
Due to an input validation bug Squid before version 4.15 is vulnerable
to a denial of service against all clients using the proxy.
Resolution
Upgrade to 4.15-1.
# pacman -Syu "squid>=4.15-1"
The problems have been fixed upstream in version 4.15.
References
https://github.com/squid-cache/squid/security/advisories/GHSA-ch36-9jhx-phm4 https://github.com/squid-cache/squid/security/advisories/GHSA-m47m-9hvw-7447 https://github.com/squid-cache/squid/security/advisories/GHSA-jjq6-mh2h-g39h https://security.archlinux.org/CVE-2021-28651 https://security.archlinux.org/CVE-2021-28652 https://security.archlinux.org/CVE-2021-28662
Workaround
- CVE-2021-28651 can be mitigated by disabling URN processing by theproxy, by adding these lines to squid.conf:acl URN proto URNhttp_access deny URN- CVE-2021-28652 can be mitigated by either disabling Cache Manageraccess entirely if not needed, by placing the following line insquid.conf before lines containing "allow":http_access deny manageror by hardening Cache Manager access privileges, for example: requireauthentication or other access controls in http_access beyond thedefault IP address restriction.- No known mitigations exist for CVE-2021-28662.